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ABSTRACT 


This thesis provides a review of the process of evaluating 
internal Ponte systems for the Federal Managers' Financial 
Integrity Act and the application of the concept of materiality 
to that process. 

Topics considered include: internal control in the 
Federal Government; internal control evaluation in the Federal 
Government; the concept of materiality in the private sector 
and the Federal Government; and guidelines for determining 
material weaknesses in internal control systems. The conclu- 
Sion was reached that with additional training in the area 
of materiality, and supported with a material weakness check- 
list, managers in the Federal Government can better fulfill 
their requirements for internal control evaluation. 

The research consisted primarily of a detailed search and 
evaluation of the literature in the area of internal control 
evaluation in the Federal Government and the concept of 
materiality both in the priváte sector andie Tederi 
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I. INTRODUCTION 


A. PURPOSE 

The Federal Managers' Financial Integrity Act of 1982 
requires the head of each executive department to report on 
their agencies' internal control systems annually. Included 
in this report is a statement on the "material weaknesses", 
if any, in the agency's system of internal control. In the 
current implementation of the act, much concern is given to 
the lack of a meaningful definition of what constitutes a 
material weakness. This confusion stems from the fact that 
the concept of materiality, a widely used accounting term in 
the private sector, is subject to considerable debate over 
its meaning and application. The purpose of this thesis is 
to review the process of evaluating internal control systems, 
and the application of the concept of materiality to that 


process. 


B. BACKGROUND 
In response to growing reports of fraud, waste and abuse 
in the Federal government the Ninety-seventh Congress of the 
United States of America passed the Federal Managers’ Finan- 
Clal Integrity Act of 1982 (FMFIA). The stated purpose 
the FMFIA is: 
To amend the Accounting and Auditing Act of 1950 


to require ongoing evaluations and reports on the adequacy 
of the systems of internal accounting and administrative 


10 


control of each executive agency, and for other purposes. 
[Ref. 1] 


The FMFIA directed the Office of Management and Budget (OMB) 
in consultation with the Comptroller General of the United 
States to establish guidelines for these evaluations and 
reports. 

The OMB responded to the requirements of the FMFIA by 
revising their Circular No. A-123. This Circular was 
Originally published in 1981 to promulgate standards of 
internal control for agencies in the Federal government. The 
revised edition incorporates the requirements of the FMFIA. 
The primary mechanism utilized by A-123 to accomplish the 
goals of the FMFIA is the requirement for each executive 
agency to conduct annual evaluations of its system of internal 
accounting and administrative control and report to the Presi- 
dent and Congress on the status of that system. An integral 
part of this report is a statement identifying material weak- 
nesses, if any, in the agencies' internal control system. 

Tt is this requirement to report on material weaknesses 
in internal control systems that has created problems in the 
implementation of the FMFIA. To report on a material weak- 
ness, one first has to understand the meaning of the term. 

In A-123, the OMB defined a material weakness as: 
«¿Ja Situation in which the designed procedures or degree 
of operational compliance therewith does not provide 
reasonable assurance that the objectives of internal con- 
trol specified in the Act are being accomplished. 
[Ref. 2] 

This definition while possibly having some meaning to persons 


familiar with the technical language of public accounting, 


Pi 


provides little guidance for the managers required to make 
the evaluations. Indeed, both the General Accounting Office 
(GAO), and the Congress in their evaluations of first year 
implementation of the FMFIA pointed out the need for a more 
practical definition of material weakness. The need for 
practical definitions stems from the fact that internal con- 
trol, materiality, reasonable assurance and other nomenclature 
used in both the FMFIA and A-123 are not normally used by 
managers of Federal agencies. To successfully implement the 
requirements of the FMFIA and A-123, agencies in the Federal 
government must provide their managers with practical defini- 


tions of these terms and their application. 


C. SCOPE AND METHODOLOGY 

The objective of this thesis is to research the concept 
of materiality, and attempt to apply it to the evaluation of 
internal control systems in the Federal government. 

The history and evolution of internal control in the 
Federal Government will be reviewed from the Accounting and 
Auditing Act of 1950, to the requirements of the Federal 
Managers' Financial Integrity Act of 1982 (FMFIA) and their 
implementation. 

The standards of internal control in the Federal Govern- 
ment will be presented in order to provide a background for 
the evaluation of internal control systems. This includes 


both the general and specific standards of internal control: 
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In depth coverage is given to the process for internal 
control evaluation in the Federal Government. The organiza- 
tion and implementation of this process is the essential 
element of the FMFIA. An understanding of this evaluation 
and the results from it, is critical to the evaluation of 
internal control weaknesses. 

Managers in the Federal Government must understand the 
concept of materiality to evaluate their systems of internal 
control for material weaknesses. Therefore, this concept is 
reviewed as it is applied in the private sector for financial 
statement reporting and auditing. Additional coverage is 
given to the concept of materiality as it is applied in the 
Federal Government. 

Using the information gained from the research, the author 
develops guidelines to assist managers in the determination of 
material weaknesses in internal control systems. These guide- 
lines are incorporated into a checklist to be used in the 
evaluation of control weaknesses. 

Finally, the conclusion is reached that managers in the 
Federal Government need more training in the concept of 
materiality. With this training and the use of aids like 
the material weakness checklist, managers in the Federal 
Government can better fulfill their requirements for internal 
control evaluation under the FMFIA. 

The research consisted primarily of a detailed search and 


evaluation of the literature in the area of internal control 
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systems and their evaluation in the Federal Government, and 


the concept of materiality. 


14 


II. INTERNAL CONTROL IN THE FEDERAL GOVERNMENT 


A. INTRODUCTION 

This chapter provides background on internal control in 
the Federal Government. Topics to be considered include the 
legislation affecting the development of internal control in 
the Federal Government, guidelines for those controls and 


the standards of internal control in the Federal Government. 


B. ACCOUNTING AND AUDITING ACT OF 1950 

The modern concept of internal control in the Federal 
Government finds its roots in the Accounting and Auditing Act 
of 1950 which required the heads of agencies in the Federal 
Government to establish and maintain adequate systems of account- 
ing and internal control. Among other requirements these 
systems were to be designed to provide "effective control 
over and accountability for all funds, property, and other 
assets for which the agency is responsible, including appro- 
priate internal audit" [Ref. 3]. 

The Act required the General Accounting Office to cooper- 
ate in the development of the internal control systems and 
the Comptroller General to approve them. In addition the 
General Accounting Office was directed to review these systems 
from time to time. However the act did not provide specific 
guidance on internal control systems or require mandatory 


reports on the quality of those systems. 
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C. OFFICE OF MANAGEMENT AND BUDGET CIRCULAR A-123 

Even though the Accounting and Auditing Act of 1950 re- 
quired the development of internal control systems, the 
development of such systems was slow. In 1980 the General 
Accounting Office released a study that disclosed instances 
of fraud, waste and abuse. In addition the study found poon 
internal controls in many agencies. [Ref. 4] 

As a result of the disclosure of fraud, waste and abuse, 
the Office of Management and Budget released Circular A-123 
in October of 1981. This circular required agencies of the 
Federal Government to establish policies on internal controls. 
It defined internal controls as: 

the plan for oragnization and all the methods and measures 
adopted within an agency to safeguard its resources, 
assure the accuracy and reliability of the information, 
assure adherence to applicable laws, regulations and 
policies, and promote operational economy and efficiency. 
(Ref. 5] 

Unlike the Accounting and Auditing Act of 1950, Circular 
A-123 directed agencies to establish directives on internal 
control, required an assessment of the inherent risk to fraud, 
waste and abuse of an activity and provided for a review of 


internal controls. These steps were taken to provide COn 


realization of the provisions of the act of 1950. 


D. FEDERAL MANAGERS' FINANCIAL INTEGRITY ACT OF 1982 
In September of 1982 the 97th Congress of the United 
States passed an amendment to the Accounting and Auditing 


Act of 1950. This Act required that each agency of the 
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Federal Government establish internal accounting and admin- 
istrative controls. The Act specifically required that 
these controls would provide reasonable assurance that: 


(1) obligations and costs are in compliance with 
applicable law; 


Ei) funds, property, and other assets are safeguarded 
against waste, loss, unauthorized use, or mis- 
appropriation; and 

(iii) revenues and expenditures applicable to agency 
operations are properly recorded and accounted 
For Ret. 6] 

Although the Act did not define the meaning of internal and 

administrative controls or what "reasonable assurance" meant, 

it did direct the Comptroller General to provide such standards. 
In an effort to insure that the requirements of this Act 

were met, Congress included a provision for the head of each 

agency to conduct an annual evaluation of their system of 

internal control. A report of this evaluation must be made 

to the President and to Congress. Among other things this 

report must include a statement that the agency's systems of 

internal and administrative controls are in compliance with 

the Act. If they are not, an additional statement identify- 

ing those material weaknesses in the agency's systems of 

internal accounting and administrative control must be included. 
The Act directed the evaluation and reporting requirements 

to be implemented in two steps. The first step was the 

preparation of guidelines for the evaluation of internal and 


administrative controls by the Office of Management and Budget 


in consultation with the Comptroller General by December 31, 
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1982. The second step required the commencement of annual 


reporting by the agencies by December 31, 1983. 


E. STANDARDS FOR INTERNAL CONTROLS IN THE FEDERAL GOVERNMENT 

In 1983 the General Accounting Office published the 
internal control standards of the Comptroller General that 
were required by the Federal Managers' Financial Integrity 
Act of 1982. This document included the following definition 
of an internal control standard; 

The internal control standards define the minimum 
level of quality acceptable for internal control systems 
in operation and constitute the criteria against which 
systems are to be evaluated. These internal «control 
standards apply to all operations and administrative 
EUnctions Red] 

This definition makes clear that these standards are to apply 
not only to traditional areas of internal controles» 
financial or accounting systems), but also to administrative 
functions. Indeed, almost every activity that is condire 
by an agency is subject to an internal control.  Thesescons 
trols may be in the form of instructions, standards Oi pews, 
formance, mission requirements, program objectives, etc. 

The standards for internal control in the Federal Govern- 
ment are broken into three areas: general standards of 
internal control, specific standards of internal control ame 
the audit resolution standard. The general and specific 
standards will be discussed in detail. 

1. General Standards of Internal Control 


The general standards apply to all aspects of internal 


control. They include the following five standards. 
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a. Reasonable Assurance 

"Internal control systems are to provide reason- 
able assurance that the objectives of the systems will be 
accomplished" [Ref. 7: p. 4]. The standard of reasonable 
assurance is subject to considerable judgment. This is be- 
cause an internal control should be cost-beneficial. The 
benefits of having the control should not outweigh the costs 
whether financial, in lost opportunity or whatever the control 
is meant to accomplish. The benefit to be derived from a 
control consists of the reduction in risk of failing to achieve 
the objective of the control. The objective might be stated 
in absolute terms such as "there will be no theft of govern- 
ment vehicles," or it may be stated as a minimum level of 
control such as "the loss of government ball point pens will 
be held to ten percent." Increasing the amount of control in 
the objective will result in an increase in cost. Therefore 
each control must be judged as to its objective, benefit and 
Cost. 

b. Supportive Attitude 

"Managers and employees are to maintain and 
demonstrate a positive and supportive attitude toward 
internal controls at all times" [Ref. 7: p. 4]. The attitude 
displayed by the management of an agency and its employees 
to internal control plays a large part in the effectiveness 
Of these controls. This standard requires that a positive 


and supportive attitude be maintained. The initiative for 
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this rests with management. Their concern for the Concept» 
implementation and operation of internal control is reflected 
in the employees. Such practices as encouraging internal 
review, providing training for employees in internal control 
and prompt response to audit findings will contribute to a 
Supportive attitude. 
c. Competent Personnel 

"Managers and employees are to have personal and 
professional integrity and are to maintain a level of compe- 
tence that allows them to accomplish their assigned duties, as 
well as understand the importance of developing and imple- 
menting good internal controls" [Ref. 7: p. 5]. Managers 
and their staffs are required to maintain and demonstrate 
integrity (both personally and professionally), an appropriate 
skill level and an understanding of internal controls suffi- 
cient for their responsibilities. Integrity is expected, and 
is maintained through codes of conduct. Personnel should be 
reminded of this obligation periodically. Personnel should 
not be hired unless they meet the minimum requirements of 
education for their job and this should be verified. In 
addition training should be provided both formally and on-the- 
job. To insure that personnel are competent they should be 
reviewed for proper performance and counseled if found to 
be lacking. 

d: ==ControlMObject Irves 
"Internal control objectives are to be identified 


or developed for each agency activity and are to be logical, 
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eetedolo, anderecasonably complete" [Ref. 7: p. 6]. The 
objectives of internal control must be tailored to the agency 
for each of its operations. To establish this the operations 
of an agency are grouped into cycles such as agency management, 
financial, program (operational) and administrative. Each 
agency must determine its cycles and establish the control 
objectives around these. It must be remembered that these 
cycles will interface with and affect the others. When these 
Seyeles are analyzed in detail it is possible to evaluate the 
objectives of the cycle and establish controls to meet those 
objectives. The standard of reasonable assurance should be 
included in this process. 
e. Control Techniques 

"Internal control techniques are to be effective 
and efficient in the accomplishment of their internal control 
objectives" [Ref. 7: p. 7]. The final general standard re- 
quires that the techniques of control are both effective and 
efficient. These techniques are the controls which accomplish 
the objectives of the agency. Such controls could be as simple 
aS a guard to prevent unauthorized entry to a secure space or 
separation of duties in a receiving department to prevent the 
person taking custody of goods to account for their receipt. 
The control could be more complex such as rules-of-engagement 
for military forces to prevent international incidents. What- 
ever their form, control techniques should insure that the 


Objective is met within the cost limitations. These 
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techniques must be subject to continuing evaluation and be 
adapted as necessary. 
ZE STE TEN nas 

Even though each agency must define its own control 
techniques, there are certain essential techniques which are 
critical to assure an agency meets their objectives. These 
are the six specific standards. 

a. Documentation 

"Internal control systems and all transactions 

and other significant events are to be clearly documented, 
and the documentation is to be readily available for examination" 
[Ref. 7: p. 8]. This standard can be summed up simply as 
"write it down." Specifically, it requires that the internal 
controls of an organization, their objectives, techniques 
and all other significant events of an organization be main- 
tained in writing. This standard insures that the agency 
has their system of internal control in directives, manuals, 
etc., and also provides auditors with a guide for their review. 

b. Recording of Transactions and Events 

"Transactions and other significant events are 

to be promptly recorded and properly classified" [Ref. 7: 
p. 9]. While similar in nature to the standard of documenta- 
tion, this standard specifically calls for the design, 
implementation and maintenance of an information system. 
While this system may be manual or automated, it should insure 


that a record is maintained of each event through its entire 
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cycle, beginning to end. This standard provides management 
with the information it needs to control operations and 
provides records for internal review and audits. 
C. Execution of Transactions and Events 

"Transactions and other significant events are 
to be authorized and executed only by persons acting within 
the scope of their authority" [Ref. 7: p. 9]. The purpose 
of this standard is to insure that an agency and its activi- 
ties only involve themselves in legitimate activities. The 
technique used is that of authorization. Without proper 
authorization a transaction should not be entered into. An 
example of this would be the fueling of a personal vehicle 
with government fuel. The control could be a lock on the 
pump with the key issued by a supervisor who maintained logs 
of vehicles fueled and miles driven. In order to insure 
compliance with this standard, authorization must be clearly 
understood by all personnel involved. 

d. Separation of Duties 

"Key duties and responsibilities in authorizing, 
processing, recording, and reviewing transactions should be 
separated among individuals" [Ref. 7: p. 10]. Key duties 
include authorizing, eroine and recording events, issuing 
and receiving assets, making payments, etc. The primary 
factor for deciding when to separate duties is if the per- 
formance of the duties by one person would allow that person 
to commit fraud, waste or abuse. An example would be an 


accounts payable clerk that issued the checks to pay those 
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accounts. This clerk could update the records that an acco mikis 
had been paid and then issue a check to him/herself. To 
prevent this, those duties are separated. It should be noted 
that this control will not prevent the collusion of two or 
more persons performing key duties. 
e. Supervision 

"Qualified and continuous supervision is to be 
provided to ensure that internal control objectives are 
achieved" [Ref. 7: p. 10]. This standard includes not only 
the monitoring of employee performance but also that they re- 
ceive training and direction. This should include the com- 
munication of duties, responsibilities and accountability to 
personnel, periodic review of performance and the approval of 
work at critical points to ensure timely completion. It is 
this standard that ties together internal controls and can 
prevent weaknesses such as collusion from occurring. 

f. Access to and Accountability for Resources 

"Access to resources and records is to be limited 
to authorized individuals, and accountability for the custody 
and use of resources is to be assigned and maintained. Periodic 
comparison shall be made of the resources with the recorded 
accountability cae whether the two agree. The fre- 


quency of the comparison shall be a function of the vulnera- 


bility of the asset” [Ref. 7: p. ll]. Every agence aang 
activity in the Federal Government has assets. These assets 
must be protected from fraud, waste and abuse. However, some 
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assets are more vulnerable to fraud, waste and abuse than 
others. This is because of factors such as; value, ease of 
theft, east of resale, etc. An example would be a comparison 
of aircraft engines and typewriters. An aircraft engine would 
not be a likely candidate for abuse because of its size and 
limited marketability. However, typewriters could be easily 
transported and are very marketable. Therefore it stands to 
reason that one requires more control than the other. Each 
agency must evaluate its resources and establish controls 

that provide reasonable assurance that these resources are 


protected and used only as authorized. 


F. CONCLUSION 

The implementation of internal control systems within the 
Federal Government has been a continuing (albeit slow) process 
over the last three decades or so. However, passage of the 
Federal Managers' Financial Integrity Act of 1982 requires 
implementation and evaluation of these controls. 

The standards for internal controls promulgated by the 
Comptroller General must be understood by personnel imple- 
menting and evaluating these systems. However, it must be 
remembered that these standards are broad guidelines and 
management is responsible for the establishment of their own 
specific controls. 

With an understanding of internal control in the Federal 
Government we will now discuss the evaluation of internal 


Semenol systems. 
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III. INTERNAL CONTROL EVALUATION IN THE FEDERAL GOVERNMENT 


A. INTRODUCTION 

The evaluation of internal controls has been practiced in 
the private sector by public accountants for a number of years. 
However, the nature and scope of these evaluations is by no 
means in general agreement. As noted in the Handbook Of 


Accounting And Auditing: 


Although auditors have studied and used evaluations 

of internal accounting controls for many years, the 

professionals still debate the best and most effective 

way to do so. [Ref. 8] 
With the passage of the Federal Managers‘ Financial Integrity 
Act of 1982, Congress directed agencies in the Federal Govern- 
ment to conduct evaluations of their systems of internal con- 
trol. Furthermore, the Act directed the Office of Management 
and Budget to develop and promulgate guidelines for the 
evaluation of internal controls. These guidelines were re- 
leased in December, 1982 and are based on technigues similar 
to those used by financial auditors to evaluate internal con- 
trol in the preparation of financial statements. However, 
the OMB guidelines are expanded to include administrative and 
program activity controls since the audit of financial state- 
ments does not normally include administrative controls. 
Rather the evaluation of internal control in the process of 
financial statement audits is designed to give the auditor 


confidence in the internal control system thus reducing the 


number of actual transactions examined. 


26 


An understanding of the internal control evaluation proc- 
ess is necessary before one can do such evaluations and ana- 
lyze the results. In the guidelines published by the Office 
of Management and Budget [Ref. 9], a seven phase approach is 
n lined for the evaluation, improvement and reporting on 
internal controls. They include the organization of the 
process, segmenting the agency for evaluation, vulnerability 
assessments, evaluation planning, conducting the evaluation, 
corrective action and reporting on the evaluation. This 


Chapter will focus on this process. 


B. ORGANIZING THE EVALUATION PROCESS 

In order for the evaluation of internal controls to be 
effective, the process must be understood by all involved. 
OrganiZing provides the framework for the remainder of the 
evaluation effort. The primary considerations for this step 
to! low. 

1. Assignment Of Responsibility 

The responsibility for the annual report required on 

the evaluation of internal controls rests with the head of 
the agency. The preparation of the report is carried out by 
the systematic delegation of duties throughout the agency. 
This delegation must be based on the size of the agency, its 
meeamization, functions, objectives, etc. However, certain 
points remain common. One is the assignment of a senior 
official with overall responsibility for the process. This 


official oversees the heads of organizational units and they 
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in turn oversee the heads of the activities they are respon- 
sible for. Ideally the process should be organized along the 
Organizational lines that the agency operates, down to the 
lowest feasible responsibility level. 

In addition to the delegation of line management 
responsibility, the Inspector General or equivalent of the 
agency, audit functions of the agency and internal review 
functions already in existence can be used to help in the 
organizing process. This can also prevent duplication of 
effort when the actual evaluation is performed. 

2. System For Internal Reporting Of Evaluation CoE 

In order to insure that the evaluation process is 
performed in a timely manner consistent with the program 
designed for the agency, there must be a system to follow-up 
and report on the process. This system should include track- 
ing for vulnerability assessments, internal control reviews 
and corrective action taken in response to weaknesses revealed 
in the evaluation. The purpose of this system is to provide 
information for annual reporting and to aid the improvement 
of internal controls by providing management with the requi- 
Site information on the evaluation. 

3. Documentation 

Just as proper documentation is a standard of internal 
control, it is also a requirement for the evaluation process. 
This documentation should consist of all instructions related 
to the implementation of the process, the record of vulnera- 


bility assessments, internal control reviews, follow-up action 
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and anything else that would be considered relevant to the 
evaluation process. This is to provide management with 
information that will confirm the validity of the evaluation 
process and/or improve it. 

4. Training And Supervision Of Personnel 

In order to provide maximum effectiveness in the 
improvement of an agency's system of internal control the 
evaluation process should involve personnel down to the lowest 
level of responsibility. In most instances these people will 
have little or no background in internal control. Therefore, 
an agency must design a program of training for these people. 
It should provide an understanding of internal controls, 
vulnerability assessments, internal control reviews and the 
like. The agency may use available information on these 
areas but it must also include their own instructions on the 
evaluation process. 

When the personnel that are involved in the process 
have received training, the evaluation can be performed but 
adequate supervision must be provided. This should include 
technical assistance, monitoring of the personnel and an 
individual appraisal of their peformance. To insure proper 
performance, personnel should be advised that their perfor- 
mance in the evaluation process will be included in their 
overall evaluation of performance. 

5. Scheduling Of The Evaluation Process 
The evaluation process is driven by the requirements 


of OMB Circular A-123. It directs that agencies shall provide 


29 


an annual statement to the President and Congress by December 
31. Scheduling of the process should insure that the infor- 
mation required for the statement is provided so as to meet 
this requirement. In the completion of the evaluation the 
agency should take into account such things as the cyclical 
nature of some operations, availability of personnel, con- 
sideration of classified activities and other matters that 
require similar forethought. The actual process of vulnera- 
bility assessments and internal control reviews will be dis- 
cussed in detail but it should be pointed out that the former 
must be conducted at least biennially and the latter ona 


continuing basis. 


C. SEGMENTING THE AGENCY 

The success of the evaluation of an agency s system of 
internal control is dependent on the implementation of the 
process throughout the agency. Segmenting the agency into 
components for evaluation and reporting purposes will insure 
that implementation. As pointed out in the OMB guidelines, 
"There is no single method to divide an agency into components, 
programs, and administrative functions..." [Ref. 10]. How- 
ever, there are fundamental principles that can be used to 
break an agency into components and programs. This results 
in an inventory of these items called assessable units. 

When completing the inventory of assessable units things 
to be considered are: 

1) Does the existing organizational structure provide a 


method for dividing the agency into assessable units? 
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2) What is the nature of the agency's programs and 
administrative functions, how are they sub-divided, 
do they cross organizational lines and what is 
their degree of independence? 


3) What are the budget levels and the amount of personnel 
incorporated in the unit? 


All of these are relevant to the segmenting process. How- 
ever, Of unique importance is whether a certain program or 
function operates in just one location or many. In the case 
where they operate in many locations, consideration must be 
given to identifying either the locations and then the func- 
tions within that location, or the functions first and then the 
locations. The method chosen is not important as long as it 
provides for complete coverage. 

When segmenting an agency two primary considerations come 
to mind. First, the intent of the legislation is to improve 
internal control in the Federal Government. Therefore, the 
division of the agency should go to the lowest level of 
responsibility. This will insure that those personnel that 
actually perform functions or administer programs will have 
a greater awareness of internal controls and their implemen- 
tation. Second, to comply with the legislation, the division 
of the agency must provide for the systematic evaluation of 
and reporting on the internal control system. This must include 
a provision for the review of the information gained by this 
evaluation as it flows up the organization. This allows 
each level of authority to evaluate any weaknesses and to 
determine if they are unique to one area or demonstrate a 


weakness that pervades their area of responsibility. 
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D. CONDUCTING VULNERABILITY ASSESSMENTS 

Prior to the actual review of internal controls in an 
agency there must be a vulnerability assessment. This is 
simply a review of all the programs and functions determined 
in the segmenting process. The purpose of the review is to 
identify any of these programs and functions which are sus- 
ceptible to waste, fraud and abuse. The vulnerability 
assessment does not evaluate the presence or effectiveness 
of internal controls. They are used to determine the poten- 
tial for loss. An example would be a cash handling function 
where large amounts of cash are received, such as the turnover 
of worn out currency by banks. Since the value and amounts 
are large, there is a potential for loss due to theft or 
fraud. This potential would be diminished through effective 
internal controls. However, the vulnerability assessment 
should only establish the potential. 

Each agency must conduct their own assessment of vulnera- 
bility and the responsibility for this is with management. 
Although personnel within the agency who perform audit functions 
can be used for technical advice and consultation, the actual 
work should be performed by all levels of management including 
the lowest possible responsibility level as determined in the 
segmenting process. There are three steps in the performance 
of a vulnerability assessment which will be covered in the 


following paragraphs. 
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1. Analysis Of General Control Environment 


The vulnerability of a program or function to fraud, 
waste and abuse are influenced in a large part by the environ- 
ment of the activity. This environment is created by several 
inherent factors within an agency, including: 


1) The attitude of management concerning the use of 
internal control systems within their activity and 
the communication of that attitude to employees. 


2) The structure of the organization. It should provide 
for proper evaluation and reporting of programs and 
functions to insure good control. 


3) Personnel should be competent in their assigned duties 
and maintain a high level of integrity. 


4) There should be delegation of authority within an 
organization that also provides the requisite responsi- 
bility and that authority and responsibility should 
be communicated to all cognizant personnel. 


Beebe policies and procedures of the Organization and 


its activities must be spelled out through directives, 
standard operating procedures and the like to insure 
compliance. 

6) The budgeting and reporting procedures used should 
reflect organizational goals and the level of the 
accomplishment of those goals. 

7) There should be existing checks and balances within 
the organization. These should provide for financial 
control, internal auditing and other management 
Sontrols. This is not an evaluation of controls but 
just the fact that they exist. 

The evaluation of the general control environment 
should be carried out throughout the agency. This can be 
performed for the agency as a whole or for separate activities, 


programs and functions. The breakdown is determined by the 


size, nature and centralization of the area being evaluated. 
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In any case, the evaluation should be conducted by consider- 
ing the policies and procedures used in the area, interviews 
with management and personnel, actual observation and the 
familiarity of the reviewer with the operation. 

2. Analyses Of Inc re nesis 

Following the evaluation of the general control 

environment each program and administrative program identi- 
fied in the segmenting process should be analyzed for its 
inherent potential risk for fraud, waste and abuse. This 
is needed as programs or functions of high risk naturally 
require more control than those with low risk. The factors 
that should be considered include: 

1) Purpose and characteristics of the program or function. 
Are they documented by directive, instruction, etc., 
and are they followed? Are there any aspects that lead 
to a higher risk? 

2) The budget allocated to the program or function. If 
the level of funding or resources (such as personnel 
and property) 1s high, there is a higher risk involved. 

3) Impact of the program or function outside the agency. 
Many programs or functions of the agency involve the 
public. A good example is the Social Security Program. 
This impact should be considered in evaluating the 
risk. 

4) Age and expected life of the program or function. 
Stable programs are generally less susceptible to risk. 
New, changing, or programs being phased out have a 
higher risk due to the environment of change they are 
in: 

5) The degree of centalization of the program or function. 
Is the level of centralization (or decentralization) 
appropriate for the activity involved? 

6) Any special concerns of the program or function. 


Special attention received by an activity from the 
President, Congress, OMB, agency heads could indicate 
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a higher risk level. Also, attention from the press, 
pending litigation and any other special considerations 
should be evaluated for their impact on an activities 
potential for fraud, waste and abuse. 

7) Prior reviews that may have been conducted of the 
program or function. Areas of vulnerability may 
already have been uncovered by other audits such as GAO, 
Inspector General, etc. If an activity receives little 
audit coverage or audits often result in disclosure 
of irregularities, then it may be more susceptible to 
risk. 

8) The management responsiveness within the program or 
function. Does management respond promptly and effec- 
tively to audit findings? An activity where this is 
not the case should be considered a higher risk. 

9) Any other factors considered to be significant. 

See Preliminary Evaluation Of Sateguards 

The final step in the assessment of vulnerability is 
a judgment by the reviewer on the existence and adequacy 
of internal controls. This is not a comprehensive review 
but an evaluation based on the knowledge of the control system 
gained during the initial steps. Of primary importance is 
whether appropriate controls are operating to prevent or 
minimize waste, fraud and abuse. 

The results of the vulnerability assessment should be 
summarized and documented to provide an overall evaluation of 
a program or functions vulnerability. The assessment should 
conclude whether a program is high, moderate or lacking in 


Wome raoility. This information is used to develop a plan 


for the internal control review process. 
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E. CONDUCTING INTERNAL CONTROL REVIEWS 
The process of evaluatinginternal control systems des- 
cribed so far is performed in preparation for the internal 
control review. This review is an in-depth examination of the 
system of internal controls (or lack of) that operate in the 
programs or functions identified in the vulnerability assess- 
ment. This review confirms that internal controls are in 
place, operating properly and in a cost-effective manner. 
The review is conducted using a six-step process detailed in 
the following paragraphs. 
l. Identification Of Eveneseycles 

In this step, the programs and functions identified 
in the vulnerability assessment are broken down into their 
event or transaction cycle. An event cycle is the process 
that 1s used to accomplish the various objectives of a program 
Or function. Most will have many event cycles. An c na 
of a procurement program event cycle would include advertising 
for copetitive bids, protection of sealed bids prior to open- 
ing, evaluation of bids received and awarding of the contract 
in accordance with applicable regulations. Additional cycles 
would follow the completion of the contract, progress payments, 
etc. An administrative function example would be a payroll 
department. Beginning with proper authorization of employment, 
pay computed using only valid time cards, proper deduction 
for Federal and State taxes, separation of duties for per- 


sonnel processing checks and those distributing them. 
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Fach event cycle represents an area that should be 
examined for internal controls. Once all event cycles are 
identified in a program or function, they should be evaluated 
for their vulnerability to risk. This is accomplished using 
the information obtained in the vulnerability assessment and 
the judgment of the reviewer. If possible, all cycles iden- 
tified should be reviewed but the highest priority rests with 
those considered most vulnerable. As with all the process 
steps, good documentation should be maintained. 

2. Analysis Of The General Control Environment 

The environment in which the internal controls to be 
reviewed operate plays a key role in their effectiveness. 

The analysis that is performed in the vulnerability assessment 
is used for this step but should be updated to reflect the 
current situation. | 

DR Documentation Of Event Cycles 

In order for a reviewer to understand the process 
involved in each event cycle complete documentation of the 
cycle is essential. This is especially true where personnel 
completing the documentation and those performing the review 
are not the same. The understanding of the event cycle is 
gained by interviews with the personnel performing the cycle, 
review of policies and procedures followed and examination 
of the records, forms and reports maintained. The documen- 
tation of the cycle can be in the form of a narrative report 


or a flowchart of the process with pertinent comments. In 


> 


either case the finished documentation should be reviewed 
with actual personnel performing the cycle to assure that 
it reflects the cycle correctly. If necessary to evaluate 
the documentation a few transactions can be traced through 
the cycle. In subsequent reviews the documentation from prior 
reviews may be used, but it must be updated each time. 

4. Evaluation Of Internal Controls 

Using the documentation of event cycles from the 

previous step the internal control system (as understood) 
is evaluated to ascertain if it fulfills the requirements 
established by the Federal Managers' Financial Integrity Act 
and OMB Circular A-123. These include: 


1) Reasonable assurance that obligations and costs are 
in compliance with applicable law. 


2) Agency funds, property and other assets are properly 
safeguarded. 


3) Revenues and expenditures are properly recorded to 
permit the preparation of reliable financial and 
statistical information. 
The first step of this evaluation is to define the control 
objectives for each event cycle. Control objectives wae 
defined in Chapter II but basically consist of the purpose 
the control system or mechanism is meant to accomplish. These 
objectives should be documented and reviewed to establish the 
objectives for each cycle are complete, relevant and make 
sense. 


After the objectives for an event cycle have been 


defined the documentation is reviewed to establish the 
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presence (or lack of) control techniques. Control techniques 
are defined in Chapter II but basically are the processes or 
documents which enable the control objectives to be met. As 
always proper documentation of the control techniques is re- 
quired. This documentation is reviewed to determine if the 
control techniques incorporated provide reasonable assurance 
that the control objectives are met. 

The inherent risks in an event cycle, the control 
objectives and control techniques form an inseparable relation- 
ship. A very good example is a cycle for accounts payable. 

An inherent risk in this cycle would be the payment of in- 
voices for goods not received. The control objective would 

be that accounts would only be paid after receipt and inventory 
of goods. The control techniques that would insure that the 
objective is meant would include receiving and inspection 
reports which the accounts payable department would receive 

and compare with vendor invoices prior to payment. Proper 
separation of the duties of receiving goods and paying for 
invoices would also be an appropriate technique in this 
example. 

The final results of the evaluation of internal con- 
trols should Menez, those that require testing, the absence 
of controls that should be corrected and excessive or unneces- 


Sary controls that could be eliminated. 


BR Testing Of Paternal Controls 


In the review process the final step is the testing 


of those controls identified in the evaluation to determine 
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if they are functioning as required. The primary estimo 
internal controls is the selection of a sample of transactions 
(generally by statistical methods) and then following the 
documentation of each transaction to ascertain its compliance 
with the internal control in question. In addition, obser- 
vations of controls functioning and interviews of personnel 
involved can be useful. When control techniques being tested 
appear to be inadequate or non-functional, an evaluation of 
personnel performing the cycle should be made to determine if 
they are compensating for the control weakness. Other tech- 
niques also might compensate for the control in question. 

The review should provide documentation for any control weak- 
nesses that were uncovered and possible corrections for them. 
6. Reporting The Results Of Internal Control Revrew 

After completion of the review of internal controls 
the results must be summarized and reported on. There are 
two reports that are required. The first report is designed 
to provide management of the program or function with infor- 
mation concerning control weaknesses uncovered and possible 
corrective action to be taken. The second report is designed 
to provide the agency head with information for the preparation 
of the el statement to the President and Congress. This 
report will include the fact that the internal control review 


was conducted and any material weaknesses uncovered. 


EA CONCLUS TON 
The guidelines for the evaluation of internal control 


systems provided by OMB are complete through the review 
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process. Personnel who have received training in internal 
control reviews should be able to implement them. However, 
the guidelines do not provide for the evaluation of control 
weaknesses in regard to materiality. This area will be 


covered in the following chapters. 
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IV. THE CONCEPT OF MATEPI RE 


A. INTRODUCTION 

After the system of internal controls has been evaluated, 
and any weaknesses uncovered, a determination must be made as 
to the materiality of the weakness. This is required so the 
agency head can report to the President and Congress on his/ 
her system of internal control in their annual report. How- 
ever, this is much easier said then done. The primary obsta- 
cle to this determination is the lack of clear guidelines as 
to what constitutes a material weakness. This chapter will 
examine the concept of materiality both in the private sector, 
and in the Federal Government. Finally, an attempt to inte- 


grate these two concepts will be made. 


Ba “THE TELUSIVE CONGEE T 

The Random House College Dictionary defines something that 
1s material as "of substantial import; of much consequence; 
important..." [Ref. ll]. This is a broad definition, Duci reS 
vides no insight on how to apply the concept. The problem 
lies not in the definition, but in the application. LONAS 
phrase a U.S. Supreme Court Justice's comment on obscenity, 
"We can't define materiality, but we know it when we see it.” 
It is clear that something that is material, is important, 
but to whom? 

A simple example illustrates that everyone has a different 


concept of what is material. A poor man walking down a sidewalk 
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spots a five dollar bill, The man, knowing it will put food 
On the table, quickly grabs it, and stuffs it in his pocket. 
To this man, five dollars and possibly less is very material. 
Another man, this one wealthy from an inheritance might pass 
this five by. Indeed, he might use five dollar bills to 
light his cigars. To this man, five dollars is immaterial. 
Now let's go back to the first man, only instead of being 
poor, imagine that he has taken a vow against materialism and 
lives in proverty by choice. This man may well pass the five 
dollars by as money is immaterial to him. Finally, imagine 
that the wealthy man became so by working his way up from 
nothing. Since this man knows the value of a dollar, he will 
scoop the bill from the sidewalk even though the five dollars 
is insignificant relative to his personal fortune. In this 
one example we can observe four quite different interpretations 
of materiality. 

From the simple example of the five dollar bill we can 
see that materiality is subject to judgment. In this example 
the element being evaluated was money. Even though it could 
be quantified in amount and its value known (in spending 
power), each person evaluated its materiality from a differ- 
ent viewpoint. The materiality of the five dollar bill could 
not be ascertained without knowing the personal value each 
person placed on it. By itself, the five dollar bill had no 


indication of its materiality. 
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It is this personal judgment, a necessary requirement to 
make decisions of materiality, that makes it an illusive 
concept. In financial accounting, the materiality concept 
has basically two applications. One involves the content of 
financial statements, while the other is concerned with the 
auditing of internal controls. Each of these meanings will 


be examined in the following paragraphs. 


C. MATERIALITY IN PRIVATE SECTOR FINANCIAL STATEMENTS 

On an annual basis most businesses in the private sector 
are required to prepare statements of their assets and liabili- 
ties (Balance Sheet), SS and expenses (Income Statement) 
and other statements to provide information on the state of 
their business. These statements are collectively called the 
financial statements of a business. After the preparation of 
statements, many businesses undergo an audit by a Certified 
Public Accountant (CPA) in order to verify the validity of 
their financial statements. This is done to satisfy many 
different parties including investors, creditors, boards, 
Federal and State agencies, etc. The goal of the CPA in his 
or her audit, is to determine if the financial statements 
fairly present the financial position of the business for 
the period that they represent. One of the major concerns 
of the CPA in regard to an audit of financial statements 
is that there are not any misstatements in the audited 
financial statements that would be considered material. How- 


ever, the problem of what constitutes a material misstatement, 
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to whom it is material and what effect the misstatement will 
have are not easily solved. 
1. Users Of Financial Statements 
The ultimate party that uses the information con- 
tained in financial statements should determine what consti- 
tues a material misstatement. As pointed out in Arthur Ander- 
sen and Company's Objectives of Financial Statements for 
Business Enterprises: 
Financial statements are for users--not directly for 
preparers, and certainly not for auditors. But, who 
are the users? What do they want? And what do they have 
a right to expect from financial statements? [Ref. 12] 
The job of the CPA then, in performing the audit, is to con- 
sider the end users and set the level of materiality accordingly. 
In a business that is privately held (no stock is bought or 
sold outside of the company), this level would be indicated by 
the Board of Directors, regulatory agencies and creditors. 
In a publicly held company, the investors and potential inves- 
tors in the business would also indicate the level of materiality 
to be considered. 
2. Information Required By Users Of Financial Statements 
Once the users of the financial statements have been 
identified, the CPA can determine what information they need. 
In the case of creditors, their primary interest is the ability 
of the business to repay their debts. On the other hand, the 
investor is looking for a return on their investment. Boards 
of Directors are assessing the performance of the officers of 


the business while regulatory agencies are concerned that the 


business is in compliance. 
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Fach user of the financial statement is concerned 
with their own interests. While some users are trained in 
accounting principles and have the financial expertise to 
properly evaluate financial statements, many (primarily small 
investors) have limited knowledge in these areas. The 
Securities and Exchange Commission has defined the materiality 
of information for investors as that information "required 
to those matters about which an average prudent investor 
Ought reasonably to be informed" [Ref. 13]. Unfortunately, 
words like "average," "prudent" and "reasonable" are just as 
ambiguous as what they are meant to define. 

If the financial statements include the information 
that the average investor or user needs, then a misstatement 
in that information that would be material would be such that 
the user would make an incorrect decision based on that infor- 
mation. In addition, the mistake would have a material conse- 
quence to the user. For example, financial statements which 
overstate assets might cause a creditor to loan more money 
to a business than they can provide security for. If that 
business subsequently goes bankrupt, and the creditor can 
not recover the value of its loan because the assets were 
overstated, then the misstatement was clearly material. Thus, 
the information that users require, is that which allows them 
to make decisions regarding the business, with reliability 
that the information is accurate enough to preclude 1rncorr 


decisions. 
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3. Standards Of Materiality In Financial Statements 
The financial statements of a business report on 
financial, external and internal aspects of the business. 
These aspects are reflected in the actual numbers and amounts 
presented, footnote disclosures and the opinion of the CPA. 
The standards for what represents materiality in the financial 
statements are set by the nature and interrelationship of 
these aspects coupled with the user requirements. The follow- 
ing will illustrate the financial, external and internal 
aspects through actual cases. 
a. Financial Aspects 
The financial aspects of financial statements are 
the actual accounts presented in the statements and their 
interrelationship. The standard for materiality in these 
accounts varies depending on the size of the business. It 
should be obvious that a large firm would not consider the 
same Foliar amount to be material that a small one would. For 
this reason, percentages of some base, are normally used to 
establish the degree of materiality. In many cases the 
percentage is varied based on what type of account is being 
looked at. For example, the income statement could be evalu- 
ated on the basis of what percentage of income the deviation 
in an account represented. A case from the not too distant 
past highlights this aspect. 
The Rockwell International Corporation suffered 


substantial losses through a computer leasing fraud they 
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entered into with OPM Leasing Services. The losses were not 
revealed in Rockwell's annual financial statements because 
they were deemed immaterial. At the time the assets of Rock- 
well amounted to 7.4 billion dollars. It was reported that 
the company's auditors (Deloitte, Haskins & Sells) had stated 
that fraud-related losses might not be considered material if 
they were less than 10 percent of shareholder equity mig 
Rockwell's case, this meant that the loss could go as high as 
220 million dollars. 

Although the amount indicated as being immaterial 
in the Rockwell case most likely would boggle the mind of 
the average investor, this type of determination continues 
to be made on a regular basis. Underlying this is the concept 
that the business is an ongoing concern. If a company can 
Sustain a loss similar to this and maintain normal operations, 
it probably is immaterial. 

b. External Aspects 

Every business is affected by the environment it 
finds itself in. Some factors of that environment the business 
Can Control: These include the type of industry that they 
Operate in, marketing area and the like. Other factors are 
not under the control of the business. These include govern- 
ment regulations, market response, competition and the like. 
Any of these factors can and do impact on the company and 
should be reflected in the financial statements if they are 


material. In some cases these factors would be disclosed by 
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footnotes to the financial statements. An example would be 
a change in depreciation method that could change the income 
(or loss) of the business. Some factors require adjustment 
of account balances, such as an adjustment for a loss in 
the value of inventory. Where a factor exists that creates 
a potential liability for the business, such as a pending 
lawsuit, the establishment of a liability account is required. 
The following case provides a good example of the 
effect of external factors on a business. In the early seven- 
ties there was a tremendous boom in the sale of Citizen's 
Band (CB) radios. Many companies (both established and new 
ones) rushed into production to meet the demand for these 
radios. One such company, Hy-Gain, was extremely successful 
in this regard. For a few years business was quite good, 
profits were made and inventory stockpiled. Then the Federal 
Communications Commission (FCC) surprised the industry by 
announcing the implementation of 17 new channels. 
With the advent of new 40 channel CB radios, Hy- 
Gain was faced with a large inventory of potentially unmarketable 
23 channel radios. At least that was the position taken by 
the manager in charge of their annual audit by Touche Ross 
& Company. She believed that the market for 23 channel CB 
radios was so limited, that the inventory of Hy-Gain should 
be substantially marked down. The management of Hy-Gain, 
understandably concerned about how investors and creditors 


would react to this move, argued against it. They insisted 
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that the 23 channel radios could be marketed at close to full 
value. In the end, management convinced the audit partner 
to follow their lead and there was no write down. Subsequent 
to this, the market for 23 channel CB radios collapsed and 
Hy-Gain along with it. 

In this case, the external factors of regulation 
and market response combined to cause a material impact on 
the financial statements. However, because management inter- 
preted the effect of the regulation to be immaterial (or 
wanted it to be), the financial statements were misstated. 
The auditors were not held accountable for failing to state 
the materiality of the situation. This is because the factor 
that caused the misstatement, the market response, was external 
and in truth, could not be predicted reliably. The private 
sector recognizes that some degree of uncertainty cannot be 
eliminated. 

c. Internal Aspects 

The information reflected in the financial state- 
ments of a business quite often are affected by factors from 
within the business. These could include accounting practices, 
Management attitude and especially internal controls. Changes 
in accounting practices usually are reflected in footnotes to 
the financial statements and include their impact on account 
balances. However, the attitude of management normally is 
not reflected in the financial statements. This is because 


they reflect the financial position of the firm andinos 
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mere ction or potential. Internal controls are also not re- 
flected directly in the financial statements, but do play a 
very important role in the CPA audit, which will be covered 
later. 

The impact of internal factors on a business can 
be significant, as the following case points out. Very 
recently, the scandalous conduct of the top executives of 
Frigitemp has been revealed. These executives actually de- 
frauded their own corporation, their CPA (Arthur Andersen & 
Company), other corporations and the Federal Government. Through 
the collusion of other executives, bribes to officials of 
other corporations and extremely clever defalcation schemes, 
the executives at Frigitemp were able to practice their fraud 
for some time. This resulted in the absence of relevant and 
material information from the financial statements of Frigitemp. 
In fact, the company went bankrupt as a result of the fraud. 
Indeed, it was bankruptcy which finally brought their conduct 
Light. 

This case brought several questions to light, such 
as what responsibility do the CPA's have to uncover fraud 
such as this. The answers will be decided in the courtroom 
and in Congress. However, it does highlight the fact that 
internal factors can be very material to the financial 
statements. 

From the previous paragraphs, we can conclude that 


the definition of what is material to the financial statements 
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of a business is the subject of much confusion. In am audis 
of financial statements, the deciding factor rests with the 
judgment of the CPA. However, the CPA must keep in mind that 
should his or her judgment be questioned, the courts may be 
called upon to decide. Even though there has been much dis- 
cussion in the accounting profession about the need for official 
guidelines for materiality, none have been forthcoming. This 
is primarily because of the inability to quantify many dis- 
similar entities into set standards. The CPA is educated, 
trained and experienced in evaluating the materiality of infor- 
mation within the financial statements. They (CPA's) must 
make judgments on materiality and be liable for them. 
Although the CPA's have been making judgments on 
materiality for many years their performance has recently 
come under attack in Congress. In an interview published in 
Management Accounting, Representative John D. Dingell was 
quoted as saying: 
I'm not sure whether the public perception of the 
narrowness of the accountants' responsibility is the 
Same as the accountants'. The accountants say they cannot 
catch fraud. We found some instances where we can 
reasonably believe that accountants in the ordinary 
exercise and skills of their trade, or just reasonable 
prudence, should have uncovered fraud...I find it very 
curious, for example, that one day a corporation gets 
a clean bill of health and within one or two days there- 
after it collapses... [Ref. 14] 
There is a growing feeling in Congress that the CPA's should 
be held accountable for more than the verification of the 


fairness of the financial statements in their audits.  Empha- 


sis in areas such as the operational control (management) of 
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the business would be new for the CPA's and would require a 


shift in their perception of materiality. 


D. MATERIALITY IN PRIVATE SECTOR AUDITING 
While the auditor is ultimately concerned with the 
financial statements and their fair presentation of the 
financial position of the business, they have different view- 
points while conducting their audit. This is because situations 
which would not be material individually to the financial 
statements may result from a larger problem that would. 
Therefore, the auditor must consider materiality in evaluations 
of internal control, compliance testing, audit procedures and 
the like. Every aspect of the audit must be consisered for 
its materiality. 
he auditor is concerned with many aspects of materiality 
in the conduct of the audit. These include the financial, 
external and internal aspects mentioned before, as well as 
economic, legal, psychological and philosophical aspects. 
Given the nature of these aspects, it appears that the 
materiality in auditing is also hard to define. Indeed, 
in an article of the Journal of Accountancy on guidance for 
auditors the authors wrote: 
It is unlikely that reliance on simple rules of thumb 
such as some percentage of income or some percentage 
of any other financial disclosure will lead to truly 
professional materiality judgments in specific audit 
situations. [Ref. 15] 


Although by no means a concise guide to materiality 


decisions, the Auditing Standards Board of the American 
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Institute of Certified Public Accountants has recently re- 
leased a new statement on materiality in auditing. It 
includes guidance for materiality in the conduct of, 
planning menos, and the evaluation of an audies 
l. Materiality mi Conducting EAn me te 

The recent Statement on Auditing Standards (SAS) 
number 47 [Ref. 16], provides guidance to the auditor on 
materiality when conducting an audit. The SAS includes 
comment on what is termed "audit risk". The meaning of audit 
risk is derived from the fact that the auditor gives his or 
her opinion on the financial statements of a business. 
Therefore, the auditor has a risk that the audit, and the 
Opinion given based on that audit, might not reveal a material 
misstatement. Accordingly, the auditor must evaluate each 
potentially material deviation in the audit in relation to 
its impact on his or her audit risk. 

The auditor's primary goal in performing the audit 
is to satisfy him/herself that the financial statements are 
fairlv presented in accordance with generally accepted 
accounting principles (GAAP). This occurs if the statements 
taken as a whole are not materially misstated, by errors or 
irregularities which might individually or in the ageregams 
result in misinformation. These errors consist of misappli- 
cations of GAAP, departures from fact, or necessary information 


being omitted. 
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While performing the audit, the auditor should con- 

Sider the nature and amount of both the errors and irregu- 
larities detected as well as the item being examined and 
their relation. Based on the auditor's perception of user 
needs and his or her professional judgment, determinations of 
materiality can be made in light of the surrounding circum- 
stances. It should be recognized that these decisions involve 
both quantitative and qualitative factors. As pointed out 
in SAS Number 47: 

.. errors of relatively small amounts detected by the 

auditor could have a material effect on the financial 

statements. For example, an illegal payment of an 

otherwise immaterial amount could be material if there 

is a reasonable possibility that it could lead to a 

material contingent liability or a material loss of 

revenue. [Ref. 17] 
The basic guidance is that materiality decisions should be 
made based on an understanding of the situation using pro- 
fessional judgment. 

2. Planning The Audit 
In an audit of a business, the auditor first considers 

materiality and audit risk when planning for the audit. This 
is especially true in light of the inverse relationship be- 
tween audit risk and materiality. For example if the account 
or transaction cycle being evaluated has a low risk of a 
large material misstatement, it could have a high risk of a 
small misstatement. Therefore, all things being equal, a 
decrease in either the level of acceptable risk or the level 


of materiality will result in a need for additional audit 


planning. 
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The planning that the auditor does for the audit 
centers around the collection of sufficient evidence to 
evaluate the financial statements. To collect that evidence 
he or she must select appropriate audit procedures Inma 
of the audit risk and materiality involved. The auditor 
must first make a preliminary judgment of materiality for 
the audit based on his or her experience and knowledge of the 
entity. The audit plan is then developed with this preliminary 
materiality level to provide the evidence required to evalu- 
ate the financial statements. The audit process itself has 
inherent limitations that also must be considered. Of primary 
consideration is the desire for the audit to be economically 
useful. That is, performed in a reasonable amount of time 
for a reasonable cost. 

After consideration of the materiality for the audit 
of the financial statements, the auditor must consider what 
level of materiality he or she will use in the evaluation of 
Specific accounts, transactions or controls. This is imeem. 
tant because an error that might not be material individually 
may be Material as the sum or errors from other accounts, 
transactions or controls. This will assist the auditor in 
determining the scope of audit procedures required. Accord- 
ing to SAS 47, there are three risks that the auditor must 
consider when planning for the audit. These are inherent 
risk, control risk and detection risk. 

The inherent risk is the susceptibility of an account 


or transaction type to material error, when aggregated with 
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error in other accounts or transaction types. Control risk 
is the risk that this same error could occur and not be pre- 
vented or detected by internal control systems. Where the 
inherent risk is high, the control risk should be low and 
vice-versa. However, these risks are not normally under the 
control of the auditor. The detection risk is under the 
auditors control and is the risk that the procedures conducted 
in the audit, will lead him or her to believe that no error 
exists, when in fact it does. Therefore, in audit planning 
the auditor should plan to lower his detection risk by using 
more effective audit procedures when the inherent or control 
risk is high. The converse is true when inherent or control 
risk is low. 

Throughout the planning of the audit, the auditor 
Must continuously evaluate his or her level of materiality. 
This evaluation is based on professional judgment taking into 
account the users of the financial statements. In the final 
analysis, it is the auditor's opinion as to whether the finan- 
cial position of the business is presented fairly. 

3. Evaluation Of The Audit 

After the conclusion of audit procedures, the infor- 
mation obtained must be evaluated in light of the materiality 
level. If the errors detected (whether individually or in 
aggregate) are material to the financial statement as a 
whole, then they must be corrected or a qualified or adverse 


opinion must be given. Once again, the errors must be 
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evaluated using both quantitative and qualitative considera- 
tions. If analytical review techniques have resulted in an 

indication of error, the auditor should use additional rr 

cedures to estimate the error. In any case, where estimates 
are used in lieu of factual data, a determination should be 

made as to the materiality of an error between the estimate 

and actual. 

Another area of consideration is the likelihood of 
errors. That is, where no errors have been detected, there 
still is a possibility of misstatement due to detection risk. 
Where this is a concern after completion of the audit, addi- 
tional procedures should be employed to lower the detection 
risk. The final evaluation of the audit rests with the audi- 
tor, who determines if he or she has sufficient evidence to 


support the financial statements. 


E. MATERIALITY IN THE FEDERAL GOVERNMENT 
Although the Federal Government maintains many audit 
agencies, both in the Executive branch and the Legislative 
branch, as well as at the agency level, there is not much 
emphasis on the concept of materiality. Indeed, the Comp- 
troller General's book of standards for governmental audits 
defines materiality as: 
The concept which refers to the significance of an 
item of information which could appear, does appears 
does not appear in a financial statement. [Ref. 18] 


While not unsound, this definition does not shed much light 


on what materiality means but evidently leaves that decision 
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K sr judgment of the auditor. For practical purposes, most 
governmental audit agencies enjoy a reputation of considering 
anything material, as they include any weaknesses uncovered 
in their audit reports. The following section attempts to 
use the concept of materiality in the private sector to 
develop one for the Federal Government. 

In the Federal Government, traditional accounting con- 
trols can be evaluated for materiality in much the same manner 
aS in the private sector. The financial aspects of accounts, 
transactions, etc., can be evaluated using percentages of 
some base. Likewise, internal and external aspects can be 
evaluated along the lines of the private sector. However, 
the Federal Government is held to a higher level of stewardship 
than the typical private sector firm because it serves the 
public trust. This must be remembered Bren considering 
materiality in the evaluation of internal and administrative 
controls in the Federal Government. The nature of the services 
provided by an agency, who is affected by them and how, is 
an important aspect of this evaluation. 

1. Output Of The Federal Government 

Most agencies of the Federal Government provide 
services and information which affect a wide range of inter- 
ested parties. (This relationship is illustrated by Figure l.) 
This may be in the form of reports like the annual internal 
control statement required by the Federal Managers' Financial 


Integrity Act. It may be information used by other agencies, 
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contractors, reporters, the public, etc. The effect that 
these services and information have on the interested parties 
may be direct, indirect, or a combination of both. Several 
examples of direct services are: 

1) Delivery of mail by the U.S. Post Office. 


2) Entitlement programs such as Food Stamps and Social 
Security. 


3) Weather forecasts by the National Weather Service. 

4) Collection of taxes by the Internal Revenue Service. 
Some services have both direct effects and indirect effects. 
Examples of these are: 

1) Air traffic control by the Federal Aviation Agency. 


2) Control of TV and radio broadcasters by the Federal 
Communications Commission. 


3) Crime prevention by the Federal Bureau of Investigation. 
Finally, some services are indirect in nature and do not 
generally have a direct impact that is measurable. Some 
examples of these are: 

1) National Defense by the Department of Defense. 

2) Diplomatic work by the Department of State. 

3) Monetary policy exercised by the Federal Reserve Board. 
Whether direct or not, the services and information provided 
by most agencies affect the parties that are interested in 
them. In order to develop a concept of materiality, these 
interested parties, their views and attitudes should be 


considered. 
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2. Identifying Interested Parties Of AMEN 


In the private sector, the users of financial state- 
ment information affect the level of materiality used in the 
evaluation of those statements by the auditor. In the 
Federal Government, the parties interested in the agency, 
their views, attitudes and impact on the agency should be 
considred in setting a level of materiality for internal 
control evaluation. These interested parties include those 
that benefit from a service, special interest groups, audit 
agencies, the courts, other agencies, Congress and the Presi- 
dent, to name a few. In addition, since the effectiveness of 
an agency may be decreased by adverse publicity, the news 
media must be considered an interested party. The public at 
large is also an interested party, because we live in a demo- 
cratic society with a relatively unlimited flow of information 
concerning public resources. 

3. Identifying The Impact Un Intere Coiro 

Once an agency has defined the group of interested 
parties it affects, it can start considering the impact os 
the services and information the agency provides on them. 
This is done by evaluating the views, attitudes and concerns 
of the parties. Several examples of this process follow. 

a. Parties Who Benefit From Agency Services 

Those parties which receive a service from an 
agency are concerned with anything that limits or deprives 


them of that service. An example would be the U.S. Post 
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Office and the delivery of mail. If a weakness prevented the 
fulfillment of the mail delivery mission, the parties who 
benefit from mail delivery would be concerned. 
b. Parties Who Control The Agency 

Every agency is under the control of managers, 
regulatory bodies, audit agencies, the courts, Congress and 
the President, among others. If there is any weakness that 
indicates a breakdown in control to these controlling parties 
they will be concerned. An example would be the recent spare 
parts problem ($500 hammers, $600 toilet seats, etc.) in the 
Department of Defense. This situation has caused increased 
attention from Congress, the GAO and other groups. This may 
result in reduced levels of funding, tighter regulation and 
other restrictions. This results from the apparent lack of 
trol by the parties that control the agency which allowed 
a situation like this to develop. 

C. Interested Parties In The Press And Media 

Most agencies in the Federal Government receive 
the attention of the news media. This is especially true 
when weaknesses are uncovered. This is because the media 
considers poor management in the government to be news. 
The spare parts problem in DOD is again an excellent example. 
When this was uncovered, it received substantial coverage 
by the media. Of course, the media coverage caused an impact 
on those who control the agency and so there was a domino 
type effect from the coverage. Generally it is safe to assume 


if an item is newsworthy, the media will give it their attention. 
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d. The Public At Large 
The democratic society in America gives each 

citizen an interest in the affairs of the Federal Government. 
In addition, there is a vast amount of information available 
to the public about government affairs. While the average 
citizen may not be affected by an agency, they may still have 
an interest in the agency. The impact on the public from an 
agency weakness may result in a decrease of public confidence. 
This in turn may result in interest from those who control 
the agency and the media. The DOD spare parts problem is 
again an excellent example. While the public may not under- 
stand complex defense issues, they do perceive that $500 is 
too much to pay for a claw hammer that is similar in all 
respects to one at the local hardware store that sells for 
$10. The concern of the public at large cannot be 
underemphasized. 

e. Other Interested Parties 

An agency of the Federal Government may have an 
impact on groups that are not normally associated with it. 
These may include foreign governments, special interest 
groups, local organizations and the like. If these other 
groups can be identified, the impact of possible agency weak- 
nesses on them should be evaluated. 
4. Developing Standards Of Mater PoR 
The standards that should be used for materiality in 


the Federal Government should be developed considering the 
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pete 


interested parties. When possible they should be quantified 
and expressed in dollars. However, in many cases the standard 
will be subjective and judgment will have to be the sole con- 
sideration. Within an agency the standards may vary down the 
organizational line and all but the smallest agencies should 
not set overall guidelines. Rather, the segments of the agency 
should develop their own standards of materiality within the 
framework of the services they provide and how they affect 
interested parties. Although an overall materiality guide- 
line can be promulgated by the agency, this guideline should 


only be used to evaluate materiality for the agency as a whole. 


F. SUMMARY 

The concept of materiality in the private sector is used 
by professional auditors (CPA's) to evaluate the presentation 
of a business's financial statements. The level of materiality 
1s based on standards developed with the user of the financial 
statement in mind. (What would the user consider to be 
material?) Armed with these guidelines, the auditor develops 
an audit plan that will provide him or her with sufficient 
evidential matter to evaluate the financial statements. This 
evidence will allow the auditor to conclude if there are any 
material misstatements. The levels of materiality are adjusted 
by the auditor to include the risk that using a certain level, 
the auditor might let a material error go undetected. 

Rather than being strict guidelines, the materiality 


levels used by the CPA are fluid and dynamic. The professional 
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judgment of the CPA must be used to make these determinations. 
The auditors that make these judgments typically have 4 to 

> years of college with an accounting major, pass aore 
qualification exam and generally have 5 or more years of audit 
experience. In addition, most auditors making materiality 
decisions have substantial experience with the business they 
are evaluating. 

Each audit requires a different perspective of materiality 
that varies with the business, users and even the auditor. 
Indeed, a study of materiality decisions made by professional 
auditors concluded "that individual differences emerge both 
in the choice of factors used by auditors to rank materiality... 
and their materiality thresholds" [Ref. 19]. Even though 
there has been continuing discussion of establishing uniform 
standards for materiality over many years, it seems that the 
nature of the concept will not allow it. However, the growing 
emphasis on a higher level of accountability will force the 
CPA's to reevaluate their perception of materiality in their 
approach tolan audit. 

The concept of materiality in the Federal Government, 
while similar in some respects to that of the private sector, 
must be applied differently. In addition to the typical 
financial, internal and external aspects, the stewardship of 
the agency to interested parties must be remembered. The 
responsibility that agencies have as a result of this steward- 


ship will always be higher than that of businesses in the 
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Private sector. The™application of materiality therefore 


must reflect that higher responsibility. 
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V. DETERMINING MATERIAL WEAKNESSES IN INTERNAL CONTROL SYSTEMS 


A. INTRODUCTION 
The final process in the evaluation of internal control 

systems for the Federal Managers' Financial Integrity Act, 
is the determination of material weaknesses. Any weaknesses 
that are deemed to be material and significant to Congress or 
the President must be included in the annual report. The OMB 
Circular A-123 defines a material weakness as: 

a Situation in which the designed procedures or degree 

of operational compliance therewith does not provide 

reasonable assurance that the objectives of internal 

control specified in the Act are being accomplished. 

[Ref. 20] 
In the previous chapters, the difficulty of applying this 
concept of materiality to the determination of material 
weaknesses was brought out. The principle of reasonable 
assurance tends to confuse the materiality issue. As defined 
in a prior chapter, reasonable assurance means that the bene- 
fit derived from the control exceeds the cost of the control. 
It seems that a correlation can be drawn between the concept 
of audit risk in the private sector and the concept of reason- 
able assurance as used in the above definition of materiality. 

In addition to the guidance given in OMB Circular A-123, 

the Committee On Government Operations of the United States 


Congress has provided their guidance. In a report on first- 


year implementation of the Act, the committee cautioned 
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against the exclusive use of the financial accounting defini- 
tion of materiality. They stated: 
... the Committee is concerned with the lack of consistency 
in agencies' implementation of the reporting requirements. 
Consistent understanding of the meaning of material weak- 
ness and full reporting of material weaknesses is central 
to achieving the accountability envisioned by the Act. 
The Committee believes that a management deficiency should 
be considered a material weakness for purposes of reporting 
under the Act if it could impair fulfillment of an 
agency's mission, deprive the public of needed government 
services, violate statutory or regulatory requirements, 
or result in a conflict of interest. [Ref. 21] 
The purpose of this chapter is to attempt to integrate the 
concept of materiality in the private sector, that of the 
Federal Government and the desire of Congress into a workable 


guideline for the determination of material weaknesses. 


B. REASONABLE ASSURANCE AND AUDIT RISK 

Audit risk as used by the auditor in the private sector 
is the risk that the audit, and the opinion given on that 
audit, might not reveal a material misstatement in the finan- 
cial statements of the business being audited. In cases 
where the possibility of a material misstatement is low, the 
audit risk is low and vice versa. The private sector auditor 
determines the scope and nature of his or her audit procedures 
based on an assessment of audit risk. If the assessment or 
audit risk is high, the scope and nature of audit procedures 
is increased and vice versa. There appears to be a similar 
correlation between the materiality of an internal control 


weakness, and reasonable assurance in the Federal Government. 
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For each area of internal control being evaluatedaan 
the Federal Government, the amount of assurance that is con- 
Sidered "reasonable" varies. For example, in the case of a 
control dealing with the safeguarding of nuclear weapons, the 
amount of assurance considered reasonable would be absolute 
assurance. In other words, any weakness in that control 
would be material. On the other hand, a control on ball 
point pens might give reasonable assurance, and sill allow 
an immaterial amount of loss. Therefore, in cases where the 
reasonable assurance that is desired from the control is 
high, the materiality threshold drops and vice versa. This 
principle, along with those developed in previous chapters, 


will be used in the guidelines for material weaknesses. 


C. GUIDELINES FOR MATERIAL WEAKNESS DETERMINATION 
Materiality decisions in the private sector are made by 
trained professionals with substantial experience in the field. 

The decisions being made in the Federal Government are made 

by line managers with limited training and experience in this 
area. For this reason, a systematic "cookbook" type approach 
should be used. This approach begins after the identification 
of weaknesses in the internal control review phase noted in: 
Chapter III. Once the internal control weaknesses have been 
identified, they should be evaluated using the following 


process. 
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1. Area Subject To Internal Control 


The first part of the weakness evaluation is a judg- 
ment on the sensitivity of the area subject to the control. 
This is where the reasonable assurance principle applies. If 
the area is very sensitive, such as nuclear weapons, the 
amount of assurance required is high. The determination is 
critical, because the level of materiality rests with the amount 
of reasonable assurance required. (This inverse relationship is 
graphically illustrated in Figure 2.) 

2. Result Of Weakness In Control 

This step involves an evaluation of what could result 
from the control weakness. If possible this result should 
be quantified. If not, then a narrative description of the 
result should be prepared. This step would also include a 
judgment as to whether the weakness impairs fulfillment of 
the agency mission, deprive the public of needed government 
services, violate statutory or regulatory requirements, or 
result in a conflict of interest. This step determines only 
the possible results but not the likelihood of those results. 

3. Likelihood Of Results From Control Weakness 

After determining the possible results from a con- 
trol weakness, the likelihood of those results occurring must 
be assessed. This judgment can be made based on statistical 
methods, prior experience or any method that can reliably 
estimate the likelihood. If there is little or no potential 


for the resutls to occur, the weakness is probably immaterial. 
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However, if the reasonable assurance required by the control 
area is high (e.g., nuclear weapons), then even a small 
likelihood could be material. In this case additional evalua- 
tion is necessary to ensure the weakness is not material. 
4. Parties Affected By Control Weakness 

At this point the focus of the evaluation changes 
from the weakness to those affected by the weakness. These 
parties include all those listed in Chapter IV as interested 
parties. In addition to the identification of these parties, 
the effect of the control weakness on them must be evaluated. 

a. How Are Parties Affected 

For each category of interested parties identified, 

a determination of how they are affected must be made. This 
does not have to be specific, but only to what extent the 
party is affected. In the case of the media, the effect 
might range from no press interest to nationwide television 
coverage. Similar correlations to this should be made for 
each category of interested party. At this step, if there is 
no effect from the control weakness on the parties identified, 
the weakness probably is not material. 

b. Reaction Of Interested Party 

If the interested party is affected by the control 

weakness, then their reaction must be evaluated. This also 
does not have to be specific but can range from no reaction 
to extreme reaction. Although there is a connection between 


the effect and the reaction, they should be evaluated 


T2 


separately to ensure that they are considered separately. 
Even some weaknesses with little effect can provoke an extreme 
reaction. 

c. Impact Of The Reaction Of Interested Party 

It there has been a determination that the 
interested party will be affected by the control weakness 
and have a negative reaction to that effect, the impactor 
that reaction must be evaluated. In the case of a controlling 
party like Congress, will the reaction result in reduced 
funding for the agency? In the case of the public, will the 
reaction result in distrust? Will the ability of the aqema, 
to fulfill its mission be diminished? These areas and more 
must be considered in this judgment. 
5. Results From Material Weakness Guidelines 

Once the control weakness has been evaluated using 
these guidelines, a judgment on the materiality of the weak- 
ness can be made. If the weakness is in a control area that 
requires a high reasonable assurance, and there is a high 
probability of adverse results, it is definitely a material 
weakness. Conversely, if it requires a low reasonable 
assurance, and there is a low probability of adverse results, 
it is definitely not a material weakness. Any weaknesses 
that lie somewhere between these extremes, are subject to 
the judgment of the evaluator as to their materiality. How- 
ever, the process of using the guidelines to evaluate the 
weakness will enhance the evaluator's knowledge of the weak- 


ness, and subsequently his or her judgment. 
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D. IMPLEMENTATION OF GUIDELINES FOR MATERIAL WEAKNESS 
DETERMINATION 


In most evaluations of internal control systems, a check- 
list type form is used. This form is adapted to fit the system 
being evaluated and often is specifically written for each 
control. This technique insures that the evaluator performs 
each and every step of the review process. This same tech- 
nique should be used for the evaluation of material weaknesses. 
A sample checklist is included as Appendix A of this thesis. 

The sample checklist is designed to be used once a weak- 
ness has been identified, and is based on the guidelines in 
this chapter. The checklist contains a 12-step process that 
helps the evaluator determine the materiality of a weakness. 
Those steps include: 

1. Area subject to control. An assessment is made on 
how sensitive the area being controlled is to risk. 

Once the sensitivity is evaluated, the reasonable 
assurance required by the control can be determined. 

2. Possible results from the control weakness. A deter- 
mination is made on the possible outcomes from the 
weakness in internal control. 

3. Likelihood of possible results from the control weakness. 
The results listed in Step 2 are evaluated for their 
potential to occur. 

4. First determination of materiality. Based on the 
information gained in Steps 1-3, the materiality of 
certain weaknesses can be ascertained. If the 
materiality of the weakness cannot be determined 
at this point, the checklist is continued. 

5. Interested parties affected by results from control 
weakness. In this step a list is made of those 


parties that could be affected by the results of the 
control weakness. 
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6. How are interested parties affected by Chen e TIREE 
The evaluator makes an assessment on the impact of the 
control weakness on the interested parties identified 
in Step 5. 


7. Second Determination of material weakness. At this 
point the materiality of certain weaknesses can be 
ascertained. The checklist is continued for those that 
are still not determinable. 


8. Reaction of interested parties to results from control 
weakness. This step evaluates the reaction of the 
parties listed in Step 5 to the effect of the control 
weakness identified in Step 6. 

9. Third determination of material weakness. Based on 
the information gained in Steps 6-8, the materiality 
of certain weaknesses can be determined. For those 
that are still not determinable the checklist is 
continued. 

10. Impact of reaction of interested party. The evaluator 
makes an assessment of the impact on the agency from 
the reactions listed in Step 8. 

11. Fourth determination of material weakness. The 
materiality of certain weaknesses can be determined at 
this point. For those that are still not determin- 
able, the checklist is continued. 

12. Final determination of material weakness. At this point 
the checklist procedure stops and the evaluator makes 
a Judgment on the materiality of the weakness. The 
logic behind this evaluation should be documented. 

The quality of the determination of materiality obtained from 
the checklist is dependent on the evaluator. It is nota 
substitute for training and experience. 

This material weakness checklist can be adapted by the 
agency and its segments to fit their specific needs. The 
establishment of specific limits of materiality (such as 
dollar limits) can be set by the segment performing the 
evaluation, or the authority it reports tov) Eliecer naa 


each weakness determined to be material, and those that are 


not definitely immaterial, should be reported to the 
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segment's next higher management responsibility level. This 
way the material weaknesses can be evaluated for that level 
as a whole, and a determination made if they should be 


reported to the next level. 
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VI. CONCLUSIONS AND RECOMMENDATIONS 


A. INTRODUCTION 

The purpose of this thesis was to review the process of 
evaluating internal control systems for the Federal Managers' 
Financial Integrity Act and the application of the concep Hoik 
materiality to that process. Pertinent information gained in 
this research was documented in the previous chapters, and 
resulted in the guidelines covered in the last chapter. This 


chapter will present conclusions and recommendations. 


B.. CONCDUSTONS 

The intent of Congress in the Federal Managers' Financial 
Integrity Act was to eliminate fraud, waste and abuse in 
agencies of the Federal Government. The main tool used in 
this effort is the internal control systems required by eden 
agency. Although Congress intended the annual reporting re- 
quirement to provide agency accountability, it did not estab- 
lish materiality guidelines. 

The lack of materiality guidelines from Congress, OMB or 
other regulatory bodies has caused confusion among most agen- 
cies about what constitutes a material weakness in internal 
controls. This confusion stems from the limited knowledge 
about the implementation and evaluation of internal controls 
in the Federal Government. Although the promulgation of 


Overall materiality standards by Congress, OMB or other 
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regulatory agency, would make the agency evaluation easier, 
it does not appear likely. 

Materiality decisions are made on a daily basis by auditors 
mee private sector. They are made based on the high level 
of education, training and experience held by these auditors. 
Since internal control evaluation and review in the Federal 
Government is performed by line managers, in most cases they 
will not be as qualified as private sector auditors. There- 
fore, managers making these evaluations need additional 
training and aids such as checklists to complete their review 
Se internal controls. 

Although overall materiality levels can be set for an 
agency to determine what material weaknesses should be reported 
in the annual statement, the level of materiality for segments 
within an agency should be developed specifically for each 
segment. The method used by some agencies of setting a quan- 
titative materiality threshold (i.e., $250,000), for use 
throughout the agency, could result in material weaknesses 
being ignored. Furthermore, this policy does not allow the 
intent of the Act to be followed. That is, the improvement 
of internal control systems throughout the agency for the pre- 
vention of fraud, waste and abuse. 

The internal control evaluation required by the Act, has 
the potential to improve the overall system of internal con- 
trol in the Federal Government. However, the Congress and 


the agencies must avoid making the evaluation simply a method 
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of meeting the annual reporting requirements. The review 
of internal controls should be conducted first for the 
evaluation and improvement of internal controls, and second 


for the annual report. 


C. RECOMMENDATIONS 
The internal control evaluation process and the deter- 
mination of material weaknesses can be improved with the 
implementation of these recommendations in Federal Government 
agencies. 
l. Increased Training For Management 
The amount of training for managers involved with 
the internal control evaluation should be increased. This 
training should include a thorough indoctrination in the 
concept of materiality and its application to the determina- 
tion of material weaknesses. 
2. Checklists For Material Weakness Determination 
The checklist included as Appendix A of this thesis 
should be used to determine material weaknesses. This check- 
list should be adapted by each segment of an agency to incor- 
porate its own unique internal control systems. Internal 
control weaknesses uncovered in the review process should be 
evaluated for materiality by using these checklists. 
3. Reporting Of Material Weaknesses 
Each segment of an agency should report the weaknesses 
that are deemed material and those that are not definitely 


immaterial (those subject to judgment), to the next 
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nos pOnsibiiiey levers. Ac each=successive level, the procëss 
Sreevaluating the materiality should be repeated to determine 
if the weakness should be reported to the next responsibility 
level. The weaknesses that are included in the annual report 
to Congress and the President should include any problem that 
is "Significant to a program or individual agency component" 
[Ref. 22]. Therefore, the dismissal of segment material 
weaknesses aS immaterial to the agency as a whole should be 
approached with caution. 
4. Establishment Of Dollar Thresholds 

Although the use of specific dollar thresholds of 
immateriality can make the determination of a material weak- 
ness easier, they are not exclusive. For example, while the 
$600 aircraft toilet seat would be well below most thresholds 
of materiality expressed in dollars, it is clear that the 
resultant press and Congressional interest makes it material. 
Therefore, dollar thresholds should be used with caution, 
and are best suited for financial accounting controls. 

5. Emphasis On Internal Control Improvement 

The annual reporting requirement was developed to 
insure that agencies in the Federal Government accounted for 
their internal control systems. However, the annual report 
must not become the means to the end. The primary focus of 
the internal control evaluation process must be on the segment 
level review. Agencies should insure that each segment evalu- 


ates their internal control system, determines weaknesses, 
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the materiality of those weaknesses and reports the findings 

to their next responsibility level. In addition, each segment 
should take steps to improve those controls which have material 
weaknesses which will result in more effective systems of 


internal control. 
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APPENDIX A 


MATERIAL WEAKNESS CHECKLIST 


For each internal control weakness discovered in the internal 


control review, complete a separate checklist. 


Internal Control Weakness 


ie area Subject To Control 
Give a brief description of area subject to control that 


contains a weakness. 


How sensitive is the area described above, to risk? This 
includes the risk of loss, fraud, waste and abuse. If a quan- 
titative threshold (i.e., dollars) is available, the sensi- 
tivity can be evaluated as the risk of exceeding that threshold. 
In addition, access the risk of impairment of mission fulfill- 
ment, deprivation of needed services to the public, violation 
of statutory or regulatory requirements and conflict of 


interest. 


SENSITIVE MODERATELY SENSITIVE NOT SENSITIVE. 


Based on the sensitivity, select the reasonable assurance 


required. There is a direct correlation between sensitivity 
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and reasonable assurance required (i.e., sensitive to risk 


equals high reasonable assurance). 
HIGH MEDIUM LOW 


2. Possible Results From Control Weakness 

Give a brief, itemized description of possible results from 
this control weakness. If the result can be quantified in 

dollars, list the amount of possible loss. Do not consider 
the likelihood of these results in this step, only the 


possibility of these results. 


3. Likelihood Of Possible Results From Control Weakness 
For every possible result included in Step 2, evaluate the 
likelihood of that result occurring. The evaluation should 


use three levels of potential: 


IN POSSIBLE NOT LIKELY 
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4. First Determination Of Material Weakness 

If at this point the control weakness being evaluated requires 
high reasonable assurance per Step l, and any results deter- 
mined in Step 2 are evaluated as likely or possible in Step 3, 
the weakness is material. If the weakness requires low 
reasonable assurance, and all results in Step 3 are not 
likely, the weakness is not material. Based on this criteria, 


select one choice for the weakness being evaluated. 
MATERIAL IMMATERIAL NOT DETERMINABLE 


If the weakness is judged to be material, it should be reported 
and corrective action taken. If the weakness is judged to 

be immaterial, no further action is required. If the 
materiality of the weakness is not determinable at this point, 
continue with the checklist. 

5. Interested Parties Affected By Results From Control Weakness 
For each result in Step 2 that is considered to be likely or 
possible in Step 3, list the categories of interested parties 
affected by the results. These can be those who benefit from 
the area in question, those who control the agency, the public 


at large, press and media or others. 
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6. How Are Interested Parties Affected By Results 

For each category of interested party determined in Step 5, 
briefly describe how they are affected by the results of the 
control weakness. The party may be affected by one or all 
possible results. This effect may be in the form of depriva- 
tion of agency services, press interest, etc. For each 


category of interested party list the effect and its impact 


as: 
SEVERE MEDIUM INSIGNIFICANT 
7. Second Determination Of Material Weakness 


If at this point, if any interested party identified in Step 
5 is evaluated in Step 6 as having a severe effect from the 
result, the weakness is material. Based on this determination, 


select one choice: 
MATERIAL NOT DETERMINABLE 


If the weakness is material, report it and take corrective 
action. If it is not determinable, continue with the 
checklist. 


8. Reaction Of Interested Parties To Results From Control 
Weakness 


If the materiality of the weakness was not determinable in 


Step 7, evaluate the reaction of all categories of interested 
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parties identified as being affected by the results of the 


control weakness in Step 6. Evaluate their reaction as: 


EXTREME MODERATE INDIFFERENT 


9. Third Determination Of Material Weakness 
If all the interested party reactions identified in Step 9 
are indifferent, the weakness is immaterial. Based on this 


determination, select one choice: 
IMMATERIAL NOT DETERMINABLE 


If the weakness is immaterial, no further action is required. 
If the materiality of the weakness is not determinable, 
continue with the checklist. 

si Tmpact Of Reaction Of Interested Party 

What will the impact of the reaction identified in Step 8 

be to the program or agency? This could reduce funding from 
Setmerolling groups, public distrust, inability to fulfill 
the mission, etc. For each reaction evaluated as extreme or 


moderate in Step 8, evaluate the impact as: 


SEVERE MODERATE INSIGNIFICANT 


87 


ll. Fourth Determination Of Material Weakness 

If any interested party reaction is evaluated as having a 
severe impact in Step 10, the weakness is material. If the 
impact is evaluated as insignificant, the weakness is proba- 
bly immaterial. Based on this determination, select one 


choice: 
MATERIAL IMMATERIAL NOT DETERMINABLE 


If the weakness is material, report it and take corrective 
action. If it is immaterial, no further action is required. 
Continue with the checklist if the materiality is not 
determinable. 

12. Final Determination Of Material Weakness 

At this point the evaluator must use his or her judgment in 
determining whether a weakness is material or immaterial. 
Based on the knowledge and experience the evaluator has, 
outside expertise if available, and any other resources, 


determine if the weakness is: 
MATERIAL IMMATERIAL 


Provide a brief narrative on the basis for this determination. 
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If the weakness is material, report it and take corrective 
action. If it is immaterial, no further action is required. 
Include this checklist with the working papers for the 


internal control evaluation. 
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